# 检查是否为root用户，脚本必须在root权限下运行 #
Opt_root(){
	echo -e "\033[33m >> 检查是否为root用户！ \033[0m"
	if [[ "$(whoami)" != "root" ]]; then
		echo -e "\033[31m >> 该脚本只能root权限执行 !\033[0m"
		exit 1
	fi
	echo -e "\033[32m >> 当前为root权限 ,符合脚本要求!\033[0m"
}

# 检查系统版本
Opt_ver(){
	echo -e "\033[33m >> 检查系统版本！ \033[0m"
	 . /etc/os-release
	ver_nunber=$VERSION_ID
	
	if [[ $PRETTY_NAME =~ "CentOS Linux 7" ]]; then
		echo -e "\033[32m >> 这是$PRETTY_NAME符合脚本要求 \033[0m"
	else
		echo -e "\033[31m >> 当前版本或者系统部匹配，脚本只支持CentOS7 x86_64 \033[0m"
		exit 1
	fi
}

# 最后安装确认，按Y继续默认N，其他按键全部退出 #
Opt_confirm(){
	yn="n"
	echo "please input [Y\N]"
	echo -n "default [N]: "
	read yn
	if [ "$yn" != "y" -a "$yn" != "Y" ]; then
		echo "bye-bye!"
		exit 0
	fi
	Opt_begin		# 倒计时 #
}

# 倒计时 #
Opt_begin(){
	for i in `seq -w 3 -1 1`
		do
			echo -ne "\b>>>>>$i";
			sleep 1;
		done
	echo -e "\b\Good Luck"
}

# done
done_ok(){
cat << EOF
+-------------------------------------------------+
|               optimizer is done                 |
|   it's recommond to restart this server !       |
|            E-mail:564001002@QQ.COM              |
|                                                 |
|             Please Reboot system                |
+-------------------------------------------------+
EOF
}
#--------------------------------------------------------------------------------------------------------
# 初始化工具安装
Opt_install_tools(){
	echo -e "\033[33m >> 初始化工具！ \033[0m"
	sleep 1
	yum -y install vim unzip openssl gcc gcc-c++ wget ntp curl yum-utils
}

# 服务status
Opt_ctl(){
	echo -e "\033[33m >> $2 $1服务！ \033[0m"
		systemctl $2 $1.service
	echo -e "\033[32m >> $2 $1服务完成！ \033[0m"
}

# 开启或关闭服务
Opt_chk(){
	echo -e "\033[33m >> $2 $1服务！ \033[0m"
		if [[ $2 == 'off' ]]; then
			systemctl disable $1.service
		else
			systemctl enable $1.service
		fi
}

# control-alt-delete
set_key(){
#set the control-alt-delete to guard against the miSUSE
rm -f /usr/lib/systemd/system/ctrl-alt-del.target
#恢复如下  init q 重新加载
# ln -s /usr/lib/systemd/system/reboot.target /usr/lib/systemd/system/ctrl-alt-del.target
echo -e "\033[31m control-alt-delete ok \033[0m"
sleep 1
}

histsize(){
#修改为记录50000条
sed -i 's/^HISTSIZE=.*$/HISTSIZE=50000/' /etc/profile
echo "local0.*                                                /var/command.log" >> /etc/rsyslog.conf
#记录命令到日志


echo "export PROMPT_COMMAND='{ msg=\$(history 1 | { read x y; echo \$y; });logger '[euid=\$(whoami)]':\$(who am i):[`pwd`]\"\$msg\"; }'" >> /etc/profile
echo "export PROMPT_COMMAND='{ msg=\$(history 1 | { read x y; echo \$y; });logger -p local0.notice -t bash -i HOST=[\$HOSTNAME],USER=\$USER,PPID=\$PPID,FROM=[\$SSH_CONNECTION],PWD=\$PWD,WHO=[\$(who am i)]: \"\$msg\"; }'" >> /etc/profile
}

#disable selinux #关闭SELINUX
selinux(){
sed -i 's/SELINUX=enforcing/SELINUX=disabled/' /etc/selinux/config
setenforce 0
echo -e "\033[31m selinux ok \033[0m"
sleep 1
}

#set the file limit
limits_config(){
#修改文件打开数
rm -f /etc/security/limits.d/0-limits-default.conf

cat >> /etc/security/limits.d/0-limits-default.conf << EOF
#

#---------custom-----------------------
#
*       soft    nproc   655350
*       hard    nproc   655350
*       soft    nofile  655350
*       hard    nofile  655350
root    soft    nproc   655350
root    hard    nproc   655350
root    soft    nofile  655350
root    hard    nofile  655350
EOF

sed -i "/^session     required      pam_limits.so/d" /etc/pam.d/login
echo ' session     required      pam_limits.so' >> /etc/pam.d/login


cat /etc/security/limits.conf | grep "^*           .*"
echo -e "\033[31m limits ok \033[0m"
sleep 1
}

# tune kernel parametres #优化内核参数
sysctl_config(){
#del
rm -f /etc/sysctl.d/0-sysctl-default.conf
#add
cat >> /etc/sysctl.d/0-sysctl-default.conf << EOF
net.core.netdev_max_backlog = 262144
net.core.somaxconn = 65535
fs.file-max = 52706963
kernel.pid_max = 4194303
net.ipv4.tcp_max_syn_backlog = 262144
net.ipv4.tcp_timestamps = 0
net.ipv4.tcp_synack_retries = 2
net.ipv4.tcp_syn_retries = 2
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_mem = 94500000 915000000 927000000
net.ipv4.tcp_fin_timeout = 30
net.ipv4.ip_local_port_range = 1024    65000
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_tw_buckets = 6000
fs.inotify.max_user_watches = 89100
EOF

#bridge
modprobe bridge
lsmod|grep bridge

#reload sysctl
/sbin/sysctl -p
echo -e "\033[31m sysctl ok \033[0m"
sleep 1
}

#set sshd_config UseDNS
ssh_GSS(){
#sed -i 's/^GSSAPIAuthentication yes$/GSSAPIAuthentication no/' /etc/ssh/sshd_config
sed -i '/^#UseDNS/s/#UseDNS yes/UseDNS no/g' /etc/ssh/sshd_config
sed -i 's/#UseDNS yes/UseDNS no/' /etc/ssh/sshd_config
#sed -i 's/#PermitEmptyPasswords no/PermitEmptyPasswords no/g' /etc/ssh/sshd_config
#/etc/init.d/sshd restart
cat /etc/ssh/sshd_config | grep -i usedns
cat /etc/ssh/sshd_config | grep -i PermitEmptyPasswords
echo -e "\033[31m sshd ok \033[0m"
sleep 1
}

# 关闭postfix
Opt_postfix(){
	echo -e "\033[33m >> 关闭postfix！ \033[0m"
		Opt_chk postfix off
		Opt_ctl postfix stop
}

stop_firewall(){
	echo -e "\033[33m >> 关闭防火墙！ \033[0m"
		Opt_chk firewall off
		Opt_ctl firewall stop
}

# 安装并更新源
Opt_yum_update(){
	echo -e "\033[33m >> 安装并更新源！ \033[0m"
	# 备份默认YUM配置
	if [ ! -e "/etc/yum.repos.d/bak" ]; then
		mkdir /etc/yum.repos.d/bak
		mv /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/bak/CentOS-Base.repo.backup
	fi
	echo -e "\033[33m >> 安装aliyun源 !\033[0m"
	# 下载安装aliyun配置
	#echo ${ver_nunber}
	wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-${ver_nunber}.repo
	# 下载安装aliyun EPEL源
	wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-${ver_nunber}.repo
	#更新系统
	echo -e "\033[33m >> 更新系统 !\033[0m"
	yum clean all && yum makecache
	yum -y update
	echo -e "\033[32m  >> YUM UPDATE 安装成功！ \033[0m"
	sleep 1
}

# 安装必要支持工具及软件工具
Opt_install_pkg(){
	echo -e "\033[33m >> 安装必要的支持工具包！ \033[0m"
	sleep 1
	if [[ ${ver_nunber} == 7 ]]; then
		yum -y install perl epel-release net-tools redhat-lsb kernel-devel 
	fi
}

other(){
# Wrong password five times locked 180s
sed -i "/^auth        required      pam_tally2.so deny=10 unlock_time=180 even_deny_root root_unlock_time=180/d" /etc/pam.d/system-auth
sed -i 'auth        required      pam_tally2.so deny=10 unlock_time=180 even_deny_root root_unlock_time=180' /etc/pam.d/system-auth
#auth required pam_tally2.so deny=10 lock_time=300 even_deny_root root_unlock_time=5
source /etc/profile
cat /etc/pam.d/system-auth | grep "auth        required      pam_tally2.so"
echo -e "\033[31m other ok \033[0m"
sleep 1
}

# ————————————————————————————————————————
# 启动安装
main(){
echo "[1]##[检查是否为root用户，脚本必须在root权限下运行]################################################################"
	Opt_root			# 检查是否为root用户，脚本必须在root权限下运行 


echo "[2]##[检查系统版本是否符合要求]################################################################"
	Opt_ver			# 检查系统版本是否符合要求


# echo "[3]##[最后安装确认，按Y继续默认N，其他按键全部退出]################################################################"
# 	Opt_confirm			# 最后安装确认，按Y继续默认N，其他按键全部退出


echo "[3]##[初始化工具安装]################################################################"
	Opt_install_tools			# 最后安装确认，按Y继续默认N，其他按键全部退出


echo "[9]##[关闭control-alt-delete]################################################################"
	set_key				#关闭control-alt-delete


echo "[14]##[histsize]################################################################"
    histsize	#设置history记录数量


echo "[10]##[关闭SELINUX]################################################################"
	selinux				#关闭SELINUX


echo "[13]##[limits设置]################################################################"
	limits_config	


echo "[17]##[内核优化]################################################################"
	sysctl_config


echo "[12]##[sshd设置]################################################################"
	ssh_GSS				#sshd设置


echo "[5]##[关闭postfix]################################################################"
	Opt_postfix			# 关闭postfix


#echo "[11]##[关闭SELINUX]################################################################"
#	stop_firewall       #关闭firewall


echo "[18]##[安装并更新源]################################################################"
	Opt_yum_update		# 安装并更新源


echo "[4]##[安装必要支持工具及软件工具]################################################################"
	Opt_install_pkg		# 安装必要支持工具及软件工具


echo "[15]##[其他配置]################################################################"
	other


echo "[19]##[end]################################################################"
	done_ok				#最后显示
}


# 入口安装，并保存日志
# if [ -s /tmp/opt-install.log ] ; then
# 	mv -f /tmp/opt-install.log /tmp/opt-install.log.bak
# fi
main 2>&1 | tee -a /tmp/opt-install-`date '+%Y%m%d-%H%M%S'`.log
# main >> /tmp/opt-install-`date '+%Y%m%d-%H%M%S'`.log
# if [ $1 = "reboot" ];then
#   server=`hostname`
#   echo "安装完成，重启！>> $server"
#   sleep 3
#   reboot
# else
#   echo "安装完成自行重启"
# fi
